Getaround Norway AS (formerly Nabobil.no AS) – Dismissed (Norway, 2023)

After the Norwegian DPA rejected a data subject’s complaint regarding alleged unlawful credit assessment, the case was forwarded to the Norwegian Privacy Appeals Board (PAB) to conclude an assessment. The data subject complained about the fact that a company operating a car rental platform (the controller) credit assessed them when the data subject wanted to rent a car through the company's platform. The car rental platform in question connects users wanting to rent out their car, and users who want to rent someone else's car. The car rental platform has committed to cover any possible additional expenses (such as tolls, extra kilometers driven, parking fees, compensations) to car owner(s), as well as, deductibles to the insurance company in cases of damage. Thereafter, the car rental platform claims the expenses form the car renter. Regarding a deposit, the car rental platform consideres a deposit inadequate, since a deposit high enough to cover the financial risks would make the rental price unacceptably high. This said, the controller argued that it is necessary to credit assess renters. The controller carried out a credit assessment on the data subject when the data subject wanted to rent a car through its platform. Due to a payment notice, the data subject was prohibited to rent a car through the platform. The controller relied on legitimate interests under Article 6(1)(f) GDPR when it processed personal data for these credit assessment purposes. The Norwegian Privacy Appeals Board (PAB) took the view that the car rental platform assumes a considerable financial responsibility when a rental agreement is entered into through its platform, and that therefore, the controller depends on renters having ability to cover possible addtitional expenses. The PAB took in consideration that the controller had stated that its commitments have caused the company large expenses as a result of non-payment. Additionally, the PAB did not disagree with the controller regarding the deposit, and the PAB took the view that a deposit is not an equally suitable measure compared to credit assessment. The PAB viewed that it is necessary for the controller to credit assess renters in order to reduce the company's financial risk. Therefore, the PAB found that the controller had a legal basis in accordance with Article 6(1)(f) GDPR to process credit information about the data subject.